Answering customer security questionnaires
A customer sends you a supplier qualification questionnaire with dozens of questions about information security. The answers are only worth as much as the evidence that goes with them: here is how to have it ready.
The supplier security questionnaire is no longer the exception
Until a few years ago the supplier security questionnaire was sent only by banks and multinationals. Today it also reaches small software houses, maintenance contractors and firms that handle data on behalf of others. The reason is that the rules shift responsibility along the supply chain: your customer has to show that it has checked you.
- NIS2. Legislative Decree 138/2024, the Italian law transposing NIS2, includes supply chain security among the mandatory measures, and from 2026 NIS entities also report their relevant suppliers to ACN, Italy's National Cybersecurity Agency. See NIS2 important entities and the NIS2 compliance plan.
- DORA. Regulation (EU) 2022/2554, applicable since 17 January 2025, requires banks, insurers and intermediaries to manage the risk from ICT service providers and to keep a register of them. See DORA.
- ISO/IEC 27001. The standard devotes several controls to the relationship with suppliers: security requirements in agreements, monitoring, management of cloud services. See ISO/IEC 27001.
- GDPR. Article 28 requires the controller to use only processors that provide sufficient assurances. See GDPR.
- Large customers and tenders. Many tender specifications require certifications, vulnerability assessment results and incident management procedures as a condition for taking part.
What they usually ask
Questionnaires vary in form, but the questions recur. Almost all of them have a second part, often implicit: "attach the evidence".
| Typical question | The evidence that answers it |
|---|---|
| Do you carry out regular vulnerability assessments? With what result? | The Cyber Risk Report in Executive format, with the results for the internal network, external network and web applications |
| Do you have an up-to-date risk analysis? | The completed Risk Assessment campaign, with inherent risk, treatment plan and residual risk |
| Do you have approved security policies and procedures? | The compliance documents: procedures with title page, revision, approval and TLP classification |
| Are you ISO 27001 certified, or to what extent do you apply its controls? | The Statement of Applicability and the gap analysis score against the standard |
| Do you use multi-factor authentication? How do you manage privileged accounts? | The Microsoft Entra ID or Google Workspace posture report, with reasoned acceptances |
| How do you handle incidents? Who is the contact person? | The CSIRT report from Incident Response, with the roles assigned and the single point of contact |
| Do you train your staff? | The Training record and the results of Cyber Awareness campaigns |
| Is monitoring continuous or occasional? | The Time Machine history: six months of checks day by day and a technical report archived every week |
From questionnaire to evidence file, in four steps
Measure where you are
The gap analysis against the standard the customer mentions, NIS2, ISO/IEC 27001 or DORA, tells you on which requirements the honest answer today is "no" or "partly".
Close the gaps that matter
The blocking questions first: critical vulnerabilities, MFA, backups, incident procedure. The simulation shows you which service moves the score the most.
Gather the evidence
Reports, procedures, the Statement of Applicability and registers come out of the platform ready to use; compliance documents carry your company's letterhead.
Answer and keep it
The same evidence serves the next customer. And next time you can show the improvement, because the history is dated.
Honest evidence holds up better
The people who assess questionnaires read many of them and recognise copied answers. Dottor Box does not embellish: an indicator that cannot be verified stays "not assessable" instead of showing as passed, an accepted finding carries its justification and flags again if the configuration changes, and in the Time Machine the months without checks remain visible.
For a demanding customer this is worth more than a perfect score: it shows that the data is measured and that you know where your limits are.
Your supplier is qualified too. Many questionnaires ask whether the ICT suppliers you use are certified. Dottor Marc S.r.l. is ISO/IEC 27001 and ISO 9001 certified, has appointed a DPO and processes data on Google cloud infrastructure and Dottor Marc's own data centres. The details are in Security and compliance.
The NIS2 supplier questionnaire, from the other side
Often whoever receives a questionnaire must in turn qualify their own suppliers: that is exactly what the customer is asking. With the Supply Chain module you put together questionnaires by supplier category, send them with a personal link, and suppliers answer without creating an account, attaching the evidence. You see where each one stands and keep the answers. So when asked "how do you check your supply chain?", you answer with a list, not an intention.
Questions about supplier security questionnaires
Why do customers send security questionnaires to suppliers?
Because rules such as NIS2, DORA, ISO/IEC 27001 and the GDPR make them responsible for the security of their supply chain. To demonstrate it, they have to ask suppliers for information and evidence and keep it. The questionnaire is the most common tool for doing so.
Do I need ISO 27001 certification to pass the qualification?
Not always. Many customers accept equivalent evidence: a risk analysis, approved procedures, vulnerability assessment results, a Statement of Applicability. Some tenders and some industries do require it explicitly, however, and it is worth checking the tender specifications before answering.
Can I hand over the full vulnerability assessment report?
It is not usually a good idea: the host-by-host detail is sensitive information. The Executive format of the Cyber Risk Report summarises the results without the technical detail, and the TLP classification indicates who may receive the document.
What do I answer if a requirement is not yet covered?
The truth, with a plan: what is missing, what you are doing about it and by when. A dated treatment plan and a score that improves over time are often accepted, whereas a positive answer you cannot back up can lose you the customer's trust at the first audit.
The modules that produce the evidence
Cyber Risk Report
The periodic report in PDF, presentation and Excel, with the chapters you choose.
Learn more ProveCompliance documents
SoA, management review minutes, evidence files, audit reports and registers.
Learn more ProveTime Machine
The calendar of checks from the last 180 days and the archive of weekly reports.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more ComplianceISO/IEC 27001
The information security management system, from the SoA to the audit.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.